AI Governance Buildup: build AI governance in 4–10 weeks
You know what your use of AI still lacks. The Buildup puts your action plan into practice in 4–10 weeks: roles, policies, training and evidence for daily work. We agree the fixed price after an initial scoping call.
Agreed fixed price from CHF 9'800Roles, policies, training with evidenceOperational in 4–10 weeks depending on the package
Free and non-binding · 30 minutes · confidential under NDA · quote within 24 hours
Law and technology from a single engagement. The team behind your AI policies has built access rights, logs and approvals for AI itself. It knows the obligation behind every rule.
For SMEs, mid-sized companies and regulated industries
Dr. iur., LL.M., CIPP/E
Sign-off by Dr. Staiger's team
Structured along ISO/IEC 42001
Certification remains your choice
Confidential, documents kept in Switzerland
NDA, duty of confidentiality, Art. 321 SCC where lawyers act
Advisory and audit kept separate
credible in front of certification bodies
Responsible for this engagement
Mohamed Afhim
Senior Associate · Data and data protection law (FADP, GDPR, EU AI Act)
Mohamed Afhim leads the Buildup and develops the AI policies and first impact assessments with your business units. The team of Dr. Dominic Staiger signs off the legal assessment and the contract clauses. Mohamed Afhim checks technical controls with the InfoSec team around Oliver Stutz, Co-Founder and head of the SIDD development centre.
The AI Governance Buildup puts your AI action plan into practice. It covers the AI inventory, risk register, AI Officer roles, policy set and Art. 4 EU AI Act training. Templates for impact assessments, a clause library for contracts and evidence in the Priverion Platform are added. After 4–10 weeks, executive management accepts the result and your AI Officer takes over. Everything follows ISO/IEC 42001:2023, with no obligation to certify.
The prerequisite is a baseline assessment, usually the AI Governance Check. We also adopt a reliable inventory from another source. If both are missing, the Essentials package first compiles a compact inventory. The Check shows what is missing. The Buildup puts it in place.
If you want the certificate from the outset, choose the ISO 42001 implementation project. The Buildup fits if you first need governance for day-to-day work.
When an AI Governance Buildup makes sense
The Buildup pays off when the need for action is known and implementation stalls. The EU AI Act applies if your AI is placed on the EU market or its output is used there. Without an EU link, the Swiss Federal Act on Data Protection (FADP) applies. EU customers and auditors still measure you against the EU AI Act.
1
The action plan exists but has not been implemented: Your AI Governance Check is months old. What is missing is a project with a responsible person, deadlines and templates.
2
AI is used everywhere, but not formally approved: Marketing works with ChatGPT. Someone has used Lovable to build a tool with customer data. Before the first incident, you need a usage policy, an approval process and an inventory. Where needed, the tool itself is checked by the Security Review for Vibe-Coded Projects.
3
You are building AI into your product: A chatbot or AI agent is used by customers in the EU. Since 02.08.2026, users must be able to tell that they are dealing with AI. Generative systems marketed before then need machine-readable marking by 02.12.2026. It matters whether you develop AI as provider or use it as deployer (Art. 3(3) and (4) EU AI Act). Customers want to see your approval practice in policy and contract.
4
Customers, auditors or the regulator ask for evidence: An EU customer wants to see your AI policy and your AI training record. Since 02.08.2026, market surveillance authorities can also demand this record. FINMA expects a central AI inventory with risk classification and clear responsibilities.
5
A high-risk system is foreseeable, and the deadline is known: AI that pre-selects job applicants or checks creditworthiness falls under Annex III EU AI Act. The obligations apply from 02.12.2027. That leaves around 13 months: one quarter to build, three quarters of demonstrable operation.
What makes us unique
Law, engineering and AI development in one team
Lawyers often lack hands-on experience with AI models, engineers the knowledge of the obligation behind a rule. Our lawyers, engineers and AI developers write the policy set together. Neither a pure law firm nor a conventional consultancy can deliver this combination. The result is rules your teams can implement and regulators and customers can follow.
01
Deep legal expertise
The team of Dr. Dominic Staiger gives every policy and contract clause its legal sign-off. Dr. Staiger is Dr. iur., LL.M. and CIPP/E as well as Attorney at Law (New York) and Solicitor (UK). Mohamed Afhim translates the EU AI Act and FADP into rules your business units apply without legal training.
02
Our own software engineers
Our development centre has built model access, logging and approvals into the Priverion Platform itself. These engineers co-write your policies for development and AI operations.
03
In-house AI development
We develop and run our own AI systems, such as the legal AI LexCommand. When a provider changes its model, we adapt our own inventory, risk register and policy.
What we build
The Buildup comprises ten building blocks. At the end every building block has an owner, meaning a responsible person in your organisation.
AI inventory and risk register: The inventory lists every AI application, the register their risks. For each application we record owner, purpose, data flows, risk class and your role as provider or deployer. A set process keeps the register in the Priverion Platform up to date.
Roles and RACI: The RACI table shows who is responsible, who contributes and who is informed. The AI Officer runs governance and reports to executive management. You staff this function internally or by mandate. Roles also include system owners, the DPO, the CISO, and approval and escalation paths. Regular reports document the duty of care of the board and management.
Policy set: Your internal AI rules in five to nine documents, depending on the package. At the top sits the AI governance directive (ISO/IEC 42001 clause 5.2). It sets out scope, principles, roles, risk appetite and approval gates before go-live. Four core policies govern AI use, procurement, data, and incidents and reporting. From Standard four more are added: development and MLOps, human oversight, transparency, and model and change management. MLOps means the operation and upkeep of AI models. Every policy is short and names its norm. Executive management puts it into force.
Development and MLOps policy: It applies if you build AI features yourself. Every component with a language model needs a threat model, meaning an analysis of possible attacks. It also covers test and approval gates, data provenance and separated environments (ISO 27001 Annex A 8.31). Logging records what a system does. Where needed, the design is reviewed by the Security Architecture Review. An AI-generated app is reviewed by the Security Review for Vibe-Coded Projects. The attack test is carried out by the AI security assessment.
AI literacy programme under Art. 4 EU AI Act: We train by role: all employees, power users, development, human oversight and contracted externals. You receive proof of attendance and an annual refresher. Art. 4 has required AI literacy measures since 02.02.2025, but no certificate. We set up the training register, which the Commission says can serve as evidence (Q&A on Art. 4 of 27.07.2026).
DPIA and FRIA templates with first runs: DPIA and FRIA are impact assessments for data protection and fundamental rights. The DPIA template follows the FADP and Art. 35 GDPR and adds AI questions. Only certain deployers need a FRIA: public bodies and services, creditworthiness checks and life or health insurance. We run two or three rounds with you and your external or internal DPO , who continues the DPIA.
Technical documentation and logging: Templates for the technical documentation under Annex IV EU AI Act, with model cards and datasheets. SMEs and small mid-caps may use a simplified version. The requirements provide for logs kept for at least six months. Deployers file the provider's information there for oversight and the DPIA.
Incident and reporting process: A runbook connects AI incidents to your reporting channels under Art. 24 FADP and Art. 33 and 34 GDPR. Serious incidents involving high-risk systems fall under Art. 73 EU AI Act. The deadline is 15 days, or 10 days in the event of death. For widespread infringements or critical infrastructure it is 2 days. Since 11.09.2026, products with digital elements are also subject to Art. 14 CRA. The runbook sets out initial assessment, roles, templates and authority contacts. We rehearse it once in a tabletop exercise.
Clause library for supplier and customer contracts: On the supplier side, it holds reviewed clauses for data processing agreements under the FADP and the GDPR. They cover training use, data location and disclosure abroad (Art. 16 and 17 FADP). Liability, audit rights, model changes and exit are added. Providers of high-risk systems receive the supplier agreement under Art. 25(4) EU AI Act. The review grid is the EU model clauses for public AI procurement (MCC-AI, version of 05.03.2025). Those who sell AI features receive templates for customer contracts. They cover roles and purpose (Art. 25(1) EU AI Act), transparency (Art. 50) and deployer support (Art. 13).
Evidence in the Priverion Platform and ISO/IEC 42001 mapping: Policies, registers, contracts and test results are held in audit-ready form in the Priverion Platform , hosted in Switzerland. At the end you receive a gap list against Annex A of the AI management standard ISO/IEC 42001:2023. Plus adds a documentation skeleton for clauses 4 to 10 with a Statement of Applicability.
Not included are certification, internal audit, management review, attack testing and ongoing operation. Only an accredited body can certify. After handover, operation passes to your owner or the external AI Officer. We do not guarantee compliance. Regulators, customers and auditors can follow our evidence.
What often remains open after the Check
Rules only work if someone maintains them. After a Check, four gaps usually remain open.
Typical gaps
A policy without an approval process: Private AI accounts are banned, but nobody can request a tool officially. So teams keep using private accounts. An inventory without an owner: After handover, nobody maintains the list from the Check. Training without a register: There is no record of who completed which training and when. Contracts without AI clauses: The 2022 data processing agreement with the cloud provider covers neither training use nor model changes.
Why policies alone are not enough
Three dated figures on AI policies and shadow AI, meaning AI use without approval. They show patterns, not your case.
20 %
of organisations with a data breach reported an incident involving shadow AI. Where it was widespread, the breach cost USD 670'000 more on average. 63 % of those affected had no finished AI governance policy yet (IBM Cost of a Data Breach Report 2025, 30.07.2025).
1 in 3
Swiss SMEs using AI has a clear data protection rule for AI. In firms with 5–9 employees it is only 23 % (AXA SME Labour Market Study 2025, 300 SMEs, 08.10.2025).
57 %
of employees who use AI conceal it or pass off AI output as their own work. Only 40 % report an employer rule on generative AI (KPMG/University of Melbourne, Trust, attitudes and use of AI, April 2025). The survey covered 48'340 people in 47 countries.
Service packages
You choose the package by number of AI applications, in-house development and regulation. All prices are excl. VAT. We agree the fixed price after an initial scoping call.
Buildup Essentials
Agreed fixed price from CHF 9'800 up to 10 AI applications · 4–6 weeks
For SMEs with up to around 50 employees that use AI tools such as ChatGPT without in-house AI development. More than ten applications or no reliable inventory: higher effort. Five to six consulting days including legal sign-off.
Inventory and action plan from the Check, or a compact new inventory
Role model with AI Officer function, system owners and escalation path
AI governance directive and four core policies: AI use, procurement and supplier due diligence, data and retention, incidents and reporting
Half-day training with evidence template, screening for impact assessments (DPIA/FRIA), review grid for supplier contracts
Evidence repository in the Priverion Platform, briefing for executive management
Agreed fixed price from CHF 16'500 recommended · up to 25 AI applications · 6–8 weeks
For companies with 50–250 employees that build their own AI features or serve EU customers. Example: AI search in your own documents (RAG). EU customers and auditors ask for exactly these rules, clauses and templates. Nine to twelve consulting days including training and legal review.
Everything in Buildup Essentials
Policy set with nine documents. In addition: development and operation of AI models, human oversight, transparency and marking, model and change management.
DPIA and FRIA templates with two first runs. Plus templates for technical documentation and logging.
Clause library for supplier and customer contracts: data processing agreement, EU AI Act obligations, training use, data location, output rights, liability, audit rights. Alignment with the EU model clauses MCC-AI and review of the three most important supplier contracts.
Two training sessions with training register: executive management half a day, employees one day or two half-days. Anyone who misses it receives a recording.
Priverion Platform with evidence, gap list against ISO/IEC 42001 Annex A, 30 days of support after handover, management report
Agreed fixed price from CHF 26'000 regulated industries and high-risk · 8–10 weeks
For companies with 250–1'000 employees, FINMA-supervised firms and healthcare. Also for groups in CH, EU and UK or with possible high-risk systems. The price depends on the number of these systems and providers. Fifteen to twenty consulting days including legal support.
Everything in Buildup Standard
High-risk readiness by role. For providers developing AI: risk management, documentation, logging, human oversight, post-market monitoring, registration. For deployers using AI: their obligations including informing workers and the FRIA where applicable. If you judge an Annex III system not to be high-risk, we document this under Art. 6(3).
Documentation framework for your AI management system under ISO/IEC 42001 with Statement of Applicability and quantified remaining effort to certification readiness.
Supplier due diligence for up to ten AI providers: questionnaire, risk rating, sub-processors. Up to five contracts reviewed clause by clause, with renegotiation points.
Workshop with the board of directors and executive management, with FINMA alignment where applicable.
An AI Governance Check from the last six months is credited: CHF 1'900 for the Basic Check, CHF 2'900 for the Standard Check. Afterwards, the external AI Officercan take over operation on request. For AI in your own products, the Buildup is also part of the AI Governance Package. In the initial consultation we narrow down the scope.
How we work
Six steps, each with an accepted deliverable. Depending on the package, your team invests three to eight workshop half-days, the training days and around one day per week. Without internal owners, governance does not last.
Free scoping
We clarify your AI applications, in-house development, the countries involved and the evidence you need. We agree the fixed price after an initial scoping call. Within 24 hours you receive scope and quote in writing. An existing AI Governance Check feeds in directly.
Kick-off and roles
We transfer the inventory and action plan into the Priverion Platform. In a workshop with executive management we clarify owner and risk class per application, approval of new tools and reporting lines. The inventory thus becomes the risk register.
Policy set
We adapt our policy templates in two rounds with your business units. Dr. Dominic Staiger's team signs off every rule legally. With the InfoSec team we check the technical requirements for feasibility.
Templates and contracts
We adapt all templates to your systems. In parallel, we review the most important supplier contracts for renegotiation points: three in Standard, five in Plus. Further contracts are covered by the AI Officer mandate or the AI Governance Package.
Training and first runs
We train executive management, employees and development and record everyone in the training register. First DPIA and FRIA runs and a tabletop incident exercise show whether templates and roles work.
Acceptance and handover
You receive the management report and the gap list. Once executive management has approved the rules, we hand over to your internal owner or the external AI Officer. For a certificate, the ISO 42001 implementation project follows on directly.
Why SIDD
What this means for you:
Every rule with its norm
Every rule names its basis in the EU AI Act, the FADP or ISO/IEC 42001. Dr. Staiger's team signs it off. Auditors find the reference without having to ask.
Workable rules for developers
Our engineers check every requirement for feasibility in the code. Whatever does not work, we rewrite before sign-off.
An owner for every building block
A named person in your organisation carries each building block forward. You know the internal time required upfront. Without owners, governance soon lapses.
Audit-ready evidence
Policies, registers, contracts and impact assessments are held audit-ready in the Priverion Platform in Switzerland. You can thus answer requests from customers and auditors within a day.
Confidential, documents kept in Switzerland
We hold your documents under NDA and duty of confidentiality on systems in Switzerland. Advice given as attorneys is also covered by attorney-client privilege (Art. 321 of the Swiss Criminal Code).
Advisory and audit kept separate
The Buildup is advisory work, not certification. We may later test a system whose governance we built. In the AI security assessment we then disclose this and separate the engagements.
Check, Buildup and AI Officer compared
The three offers build on one another: baseline assessment, implementation, ongoing leadership.
AI Governance Check
AI Governance Buildup
AI Officer
Purpose: baseline assessment with inventory, classification and action plan
Purpose: implementing the action plan as a project with acceptance
Purpose: ongoing AI governance as an external mandate
Deliverable: report, action plan, summary for the board and executive management
Deliverable: roles, policy set, training register, templates, clause library, evidence in the Priverion Platform
Deliverable: maintained inventory, reports to executive management, named point of contact
Duration: 3–5 weeks
Duration: 4–10 weeks depending on the package, then handover
Duration: ongoing, three months' notice
Price: from CHF 3'900 (Basic), from CHF 7'500 (Standard), Enterprise on request
Agreed fixed price from CHF 9'800 (Essentials), from CHF 16'500 (Standard), from CHF 26'000 (Plus)
Price: Readiness from CHF 500/month, Governance CHF 1'500–3'500/month, Full mandate on request
When it makes sense: you need a baseline assessment
When it makes sense: you know the gaps and want to close them
When it makes sense: someone should lead the governance for you permanently
Internal effort: interviews and documents
Internal effort: 3–8 workshop half-days, about one coordination day per week, owners, sign-offs
Internal effort: points of contact per area, sign-offs
Next step: Buildup, AI Officer mandate or in-house implementation
Next step: AI Officer internal or external, optionally the ISO 42001 implementation project
Next step: takes over the Buildup deliverables and carries them forward
Why we work with LexCommand, our own Swiss legal AI
LexCommand is our in-house, citation-backed legal AI for the law of Switzerland, Germany, Austria and the EU. Developed and run sovereignly in Switzerland by Priverion GmbH, the company behind SIDD. We do not just preach data sovereignty and provability, we built them into our own tool, alongside the Priverion Platform.
01
Sovereign in Switzerland
The AI runs self-hosted on Swiss infrastructure, with no external cloud LLMs. As an independent Swiss company with no foreign parent, we process your documents in an environment we control.
02
No citation, no claim
Every legal statement traces back to a retrievable primary source, or it does not appear at all. That makes our recommendations auditable and verifiable, instead of merely sounding plausible.
03
From effort to judgement
LexCommand takes over searching, cross-checking and sourcing. That shortens turnaround times and frees our senior advisors for judgement and client dialogue, with no loss of diligence.
04
Three disciplines, one picture
We look at data protection, information security and AI security on a shared source base with a framework crosswalk. So you see overlapping obligations in one consolidated picture, instead of three isolated analyses.
In the Buildup, LexCommand cites the source for every policy and clause: EU AI Act, FADP or ISO/IEC 42001 Annex A. It places matching obligations from several frameworks side by side.
Temporally deterministic (as of today or any reference date), with jurisdiction isolation (CH/DE/AT/EU) and a citation verifier at the end of every answer.
Frequently asked questions
What does the Buildup cost, and how long does it take?
Essentials: agreed fixed price from CHF 9'800 in 4–6 weeks. Standard: agreed fixed price from CHF 16'500 in 6–8 weeks. Plus: agreed fixed price from CHF 26'000 in 8–10 weeks. All prices are excl. VAT. We agree the fixed price after an initial scoping call. Your team provides three to eight workshop half-days, around one coordination day per week and one responsible person per building block.
Do we need the AI Governance Check first?
Not necessarily: a reliable inventory from another source also works. The route via the AI Governance Check is usually quicker and not more expensive. The Check delivers inventory, classification and action plan from CHF 3'900 in 3–5 weeks. If it is no more than six months old, we credit CHF 1'900 (Basic Check) or CHF 2'900 (Standard Check).
What distinguishes the Buildup from the ISO 42001 implementation project?
For a certificate from the outset, the ISO 42001 implementation project is the direct route. It takes your AI management system under ISO/IEC 42001 to certification readiness, with internal audit (clause 9.2) and management review (9.3). The Buildup builds governance for day-to-day operation and covers more ground: usage rules, contracts, training, development. Buildup Plus delivers the documentation skeleton with Statement of Applicability and quantifies the remaining effort to certification readiness.
Who runs the governance after handover?
After acceptance by executive management, we hand over to a named person in your organisation. This includes a reporting rhythm, a maintenance process and one responsible person per building block. If you lack capacity or expertise internally, the external AI Officer takes over ongoing management and keeps your rules up to date. In the AI Governance Package the Buildup is the setup building block, with one contact for governance, security assessments, data protection mandate and contract reviews.
We have no EU customers. What are we building this for?
For obligations that already apply: Art. 21 FADP on automated individual decisions and Art. 22 FADP on data protection impact assessments. Add to this the duty of care of the board and management (Art. 717 or 812 CO). The EU AI Act already applies when the output of your AI is used in the EU (Art. 2(1)(c)). The Buildup assigns every rule to its legal basis, so future obligations also fit into existing roles and registers.
Our AI policy comes from a template. What does the Buildup add?
A template sets out prohibitions, but not approvals, personal data or tools on private accounts. The Buildup adds the approval process, the inventory with owners, the training register under Art. 4 EU AI Act and AI clauses for suppliers. According to the AXA SME Labour Market Study 2025 only a third of Swiss SMEs using AI have a clear data protection rule for it. Essentials aligns your policy with the EU AI Act and the FADP and builds the processes around it in 4–6 weeks.
We have high-risk candidates under Annex III. Is the Buildup enough?
For the preparation, yes: the Plus package covers the obligations of your role as provider or deployer. Before that, the AI Governance Checkclarifies whether a system is actually high-risk. Annex III obligations apply from 02.12.2027, and from 02.08.2028 for AI in products under Annex I. As of 21.07.2026 the EU Official Journal listed no harmonised standard, so even ISO/IEC 42001 gives no presumption of conformity.
We are FINMA-supervised. Does the Buildup cover the supervisory expectations?
The ten building blocks map onto FINMA Guidance 08/2024, from governance (section 2.1) to explainability (section 2.6). In the Plus package we map every building block to these sections and to FINMA Circular 2023/01 (operational risks). We anchor ongoing monitoring (section 2.4) in model and change management and in reporting to executive management. We do not carry out the independent review (section 2.7) ourselves, because we built the governance.
How does the Buildup relate to our DPO mandate?
Your external or internal DPO advises and monitors under Art. 10 FADP. The Buildup adds AI templates for DPIA and FRIA, rules on automated individual decisions and AI clauses for data processing agreements. The role model sets out joint decisions with the AI Officer, for instance on new AI tools involving personal data. If we already act as your external DPO from CHF 500/month, scoping is shorter.
This page does not replace legal advice in individual cases.
Build AI governance your teams actually apply
30 minutes with Mohamed Afhim: you learn which package fits. We agree the fixed price after an initial scoping call. The quote follows within 24 hours.
